@maxal_studio/kratosjs-react 1.0.0

package/src/index.ts

@@ -0,0 +1,244 @@
+// Main exports
+export { FormRenderer } from './FormRenderer';
+export { FieldRenderer } from './FieldRenderer';
+
+// Plugin-author API
+export { definePluginClient, mergePluginClients } from './plugin';
+export type { KratosPluginClient, MergedPluginRegistries } from './plugin';
+
+// App entry (mount the admin SPA)
+export { mountAdminPanel } from './app';
+export type { MountAdminPanelOptions } from './app';
+
+// Field registry
+export { FieldRegistryProvider, FieldRegistryContext, useFieldRegistry } from './contexts/FieldRegistryContext';
+export type { FieldRegistryProviderProps } from './contexts/FieldRegistryContext';
+
+// Hooks
+export { useValidation } from './hooks/useValidation';
+
+// Field utilities (for custom field components)
+export { getFieldError } from './utils/fieldErrors';
+
+// HTTP / API layer
+export { ApiError, apiFetch, apiGet, apiPost } from './api/http';
+export { TableApiClient } from './api/tableApi';
+export type { QueryParams, QueryResult, PaginationMeta } from './api/tableApi';
+export { executeAction, executeBulkAction } from './api/actionsApi';
+export type { ActionResult } from './api/actionsApi';
+export * as resourceApi from './api/resourceApi';
+export { authenticatedFetch } from './api/authenticatedFetch';
+export { deriveApiBaseUrl, resourceSlugFromUrl } from './api/urls';
+
+// Condition / serialized-function runtime
+export { evaluateCondition, evaluateConditionAst } from './runtime/conditions';
+export type { Condition, ConditionAst, ConditionOperator } from './runtime/conditions';
+export { executeSerializedFunction, compileSerializedFunction } from './runtime/serializedFunctions';
+
+// UI primitives (stable styling contract for plugin authors)
+export {
+	Button,
+	IconButton,
+	Input,
+	Textarea,
+	Select,
+	Label,
+	Badge,
+	Card,
+	Spinner,
+	EmptyState,
+	ErrorAlert,
+	ToastProvider,
+	useToast,
+	ConfirmProvider,
+	useConfirm,
+} from './components/ui';
+export type {
+	ButtonProps,
+	IconButtonProps,
+	ButtonVariant,
+	ButtonSize,
+	InputProps,
+	TextareaProps,
+	SelectProps,
+	LabelProps,
+	BadgeProps,
+	BadgeVariant,
+	CardProps,
+	SpinnerProps,
+	EmptyStateProps,
+	ErrorAlertProps,
+	ToastApi,
+	ToastOptions,
+	ToastVariant,
+	ConfirmOptions,
+} from './components/ui';
+export { ErrorBoundary } from './components/errors/ErrorBoundary';
+export type { ErrorBoundaryProps } from './components/errors/ErrorBoundary';
+
+// Filter Components
+export { QueryBuilderFilterComponent } from './components/filters/QueryBuilderFilterComponent';
+export { CustomFilterComponent } from './components/filters/CustomFilterComponent';
+
+// Types
+export type {
+	FieldProps,
+	FieldComponent,
+	FieldRegistry,
+	FormRendererProps,
+	FieldRendererProps,
+	RHFValidationRules,
+	SerializedRelation,
+} from './types';
+
+// Built-in field components (for custom rendering or extending)
+export { TextInputField } from './components/TextInputField';
+export { SelectField } from './components/SelectField';
+export { TextareaField } from './components/TextareaField';
+export { CheckboxField } from './components/CheckboxField';
+export { ToggleField } from './components/ToggleField';
+export { RadioField } from './components/RadioField';
+export { DateTimePickerField } from './components/DateTimePickerField';
+export { ColorPickerField } from './components/ColorPickerField';
+export { RepeaterField } from './components/RepeaterField';
+export { HiddenField } from './components/HiddenField';
+export { FileUploadField } from './components/FileUploadField';
+export { RichEditorField } from './components/RichEditorField';
+export { SectionField } from './components/SectionField';
+export { GroupField } from './components/GroupField';
+export { HintDisplay } from './components/utils/HintDisplay';
+export type { HintDisplayProps } from './components/utils/HintDisplay';
+export { ViewFieldWrapper } from './components/utils/ViewFieldWrapper';
+export type { ViewFieldWrapperProps } from './components/utils/ViewFieldWrapper';
+
+// Utilities
+export { cn } from './utils/classNames';
+
+// Icon component and types
+export { Icon } from './components/utils/Icon';
+export type { IconName, IconProps } from './components/utils/Icon';
+// Re-export all Lucide icons for convenience
+export * from 'lucide-react';
+
+// Table
+export { TableRenderer } from './TableRenderer';
+export type { TableRendererProps } from './TableRenderer';
+export { useTableContext } from './table/TableContext';
+export type { TableContextValue } from './table/TableContext';
+
+// Modals
+export { ViewModal } from './components/ViewModal';
+export { ResourceFormModal } from './components/modals/ResourceFormModal';
+export type { ResourceFormModalProps } from './components/modals/ResourceFormModal';
+export { RelationCreateModal } from './components/modals/RelationCreateModal';
+export { ActionFormModal } from './components/ActionFormModal';
+export { ModalDrawer } from './components/ModalDrawer';
+export { useResourceForm } from './components/modals/useResourceForm';
+export type { UseResourceFormOptions, ResourceFormApi, ResourceFormMode } from './components/modals/useResourceForm';
+
+// Table context
+export { ColumnRegistryProvider, useColumnRegistry } from './contexts/ColumnRegistryContext';
+export type { ColumnRegistry, ColumnComponent } from './contexts/ColumnRegistryContext';
+
+// Modal context
+export { ResourceModalProvider, useResourceModal } from './contexts/ResourceModalContext';
+export type { ModalState } from './contexts/ResourceModalContext';
+
+// Panel metadata context
+export { PanelMetadataProvider, usePanelMetadata } from './contexts/PanelMetadataContext';
+export type { PageMetadata } from './contexts/PanelMetadataContext';
+
+// Table column components (for custom rendering or extending)
+export { TextColumnComponent } from './components/columns/TextColumnComponent';
+export type { ColumnProps } from './components/columns/TextColumnComponent';
+export { IconColumnComponent } from './components/columns/IconColumnComponent';
+export { ImageColumnComponent } from './components/columns/ImageColumnComponent';
+export { VideoColumnComponent } from './components/columns/VideoColumnComponent';
+export { MediaColumnComponent } from './components/columns/MediaColumnComponent';
+export { ColorColumnComponent } from './components/columns/ColorColumnComponent';
+export { TagsColumnComponent } from './components/columns/TagsColumnComponent';
+export { ViewColumnComponent } from './components/columns/ViewColumnComponent';
+export { CheckboxColumnComponent } from './components/columns/CheckboxColumnComponent';
+export { ToggleColumnComponent } from './components/columns/ToggleColumnComponent';
+export { SelectColumnComponent } from './components/columns/SelectColumnComponent';
+export { TextInputColumnComponent } from './components/columns/TextInputColumnComponent';
+
+// AdminPanel component
+export { AdminPanel } from './components/AdminPanel';
+export type { AdminPanelProps, BlockRegistry } from './types';
+
+// Internationalization (i18n)
+export {
+	I18nProvider,
+	useI18nContext,
+	useTranslation,
+	useLocale,
+	useFormatter,
+	LocaleSwitcher,
+	getActiveLocale,
+	translate,
+	buildClientI18n,
+} from './i18n';
+export type {
+	I18nContextValue,
+	I18nProviderProps,
+	ClientI18nConfig,
+	ClientTranslations,
+	LocaleSwitcherProps,
+} from './i18n';
+
+// Auth components
+export { AuthProvider, useAuth } from './auth/AuthContext';
+export { LoginPage } from './auth/LoginPage';
+export { ProtectedRoute } from './auth/ProtectedRoute';
+export { AuthApiClient } from './auth/authApiClient';
+export type {
+	AuthUser,
+	AuthProvider as AuthProviderType,
+	AuthTokens,
+	LoginCredentials,
+	LoginResult,
+	PendingChallenge,
+	AuthChallengeProps,
+	AuthChallengeComponent,
+} from './auth/types';
+export {
+	AuthChallengeRegistryProvider,
+	AuthChallengeRegistryContext,
+	useAuthChallengeRegistry,
+} from './contexts/AuthChallengeRegistryContext';
+export type { AuthChallengeRegistry } from './contexts/AuthChallengeRegistryContext';
+
+// Widget exports
+export { WidgetRegistryProvider, useWidgetRegistry } from './contexts/WidgetRegistryContext';
+export { StatsWidget } from './components/widgets/StatsWidget';
+export { ChartWidget } from './components/widgets/ChartWidget';
+export { WidgetRenderer } from './components/widgets/WidgetRenderer';
+export type { WidgetComponentProps } from './contexts/WidgetRegistryContext';
+export type { StatsWidgetProps } from './components/widgets/StatsWidget';
+export type { ChartWidgetProps } from './components/widgets/ChartWidget';
+export type { WidgetRendererProps } from './components/widgets/WidgetRenderer';
+
+// Slots (additive UI injection points)
+export { Slot, SlotCluster, renderSlot, SLOT_NAMES } from './slots';
+export type {
+	SlotProps,
+	SlotClusterProps,
+	SlotName,
+	BuiltInSlotName,
+	SlotContext,
+	SlotRender,
+	SlotContribution,
+	SlotMap,
+	ResolvedSlots,
+} from './slots';
+export { SlotRegistryProvider, SlotRegistryContext, useSlot, useSlotRegistry } from './contexts/SlotRegistryContext';
+export type { SlotRegistryProviderProps } from './contexts/SlotRegistryContext';
+
+// Block registry (custom blocks)
+export { BlockRegistryProvider, useBlockRegistry } from './contexts/BlockRegistryContext';
+export type {
+	CustomBlockComponentProps,
+	CustomBlockComponent,
+	BlockRegistry as BlockRegistryType,
+} from './contexts/BlockRegistryContext';

package/src/pages/ResourceListPage.tsx

@@ -0,0 +1,205 @@
+import React, { useState, useEffect, useCallback } from 'react';
+import { useParams, useNavigate, useLocation } from 'react-router-dom';
+import { Loader2 } from 'lucide-react';
+import { SerializedTable } from '@maxal_studio/kratosjs';
+import { TableRenderer } from '../TableRenderer';
+import { authenticatedFetch } from '../api/authenticatedFetch';
+import { useResourceModal } from '../contexts/ResourceModalContext';
+import { useTableRefresh } from '../contexts/TableRefreshContext';
+import { PillButton } from '../components/ui/PillButton';
+import { translate } from '../i18n/activeLocale';
+
+export interface ResourceListPageProps {
+	apiBaseUrl: string;
+	resourceSlug: string;
+	resourceName: string;
+	pluralLabel: string;
+}
+
+export function ResourceListPage({ apiBaseUrl, resourceSlug, resourceName, pluralLabel }: ResourceListPageProps) {
+	const navigate = useNavigate();
+	const location = useLocation();
+	const { openModal, closeAllModals, clearModalsForResource } = useResourceModal();
+	const [tableSchema, setTableSchema] = useState<SerializedTable | null>(null);
+	// Track which resource the current tableSchema belongs to, to avoid mismatches on navigation
+	const [tableSchemaResource, setTableSchemaResource] = useState<string | null>(null);
+	const [canCreate, setCanCreate] = useState<boolean>(true);
+	const [canEdit, setCanEdit] = useState<boolean>(true);
+	const [canDelete, setCanDelete] = useState<boolean>(true);
+	const [canView, setCanView] = useState<boolean>(true);
+	const [loading, setLoading] = useState(true);
+	const [error, setError] = useState<string | null>(null);
+	const [refreshKey, setRefreshKey] = useState(0);
+	const { registerRefresh } = useTableRefresh();
+
+	// Register refresh callback for this resource
+	useEffect(() => {
+		const unregister = registerRefresh(resourceSlug, () => {
+			setRefreshKey(prev => prev + 1);
+		});
+		return unregister;
+	}, [resourceSlug, registerRefresh]);
+
+	// Parse route to determine which modal to show via context
+	// This only manages modals for THIS resource (URL-based modals)
+	useEffect(() => {
+		const pathParts = location.pathname.split('/').filter(Boolean);
+		const resourceIndex = pathParts.indexOf(resourceSlug);
+
+		if (resourceIndex === -1) {
+			// Not on this resource page anymore, clear only this resource's modals
+			clearModalsForResource(resourceSlug);
+			return;
+		}
+
+		const nextPart = pathParts[resourceIndex + 1];
+		const thirdPart = pathParts[resourceIndex + 2];
+
+		// Check for edit route: /resourceSlug/:id/edit
+		if (nextPart && thirdPart === 'edit') {
+			if (canEdit) {
+				openModal(resourceSlug, 'edit', nextPart);
+			}
+		} else if (nextPart === 'create') {
+			// Check for create route: /resourceSlug/create
+			if (canCreate) {
+				openModal(resourceSlug, 'create');
+			}
+		} else if (nextPart && nextPart !== 'create' && nextPart !== 'edit') {
+			// It's an ID for view: /resourceSlug/:id
+			if (canView) {
+				openModal(resourceSlug, 'view', nextPart);
+			}
+		} else {
+			// Just the resource slug, no modals in URL: /resourceSlug
+			// Clear only this resource's URL-based modals (keeps cross-resource modals open)
+			clearModalsForResource(resourceSlug);
+		}
+		// location.key is included so the effect re-fires even when the pathname
+		// hasn't changed from React Router's perspective — this happens after a
+		// replaceState (back/breadcrumb) when the user clicks the same row again.
+		// navigate() always produces a new location.key, replaceState never does.
+	}, [location.pathname, location.key, resourceSlug, canCreate, canEdit, canView, openModal, clearModalsForResource]);
+
+	// Fetch table schema
+	useEffect(() => {
+		const fetchTableSchema = async () => {
+			setError(null);
+			try {
+				const response = await authenticatedFetch(
+					`${apiBaseUrl}/${resourceSlug}/schema/table`,
+					{
+						headers: {
+							'Content-Type': 'application/json',
+						},
+					},
+					apiBaseUrl,
+				);
+				if (!response.ok) {
+					if (response.status === 401) {
+						throw new Error('Unauthorized - Please login again');
+					}
+					const error = await response.json();
+					throw new Error(`Failed to fetch table schema: ${error.message || response.statusText}`);
+				}
+				const data = await response.json();
+				setTableSchema(data.schema);
+				setTableSchemaResource(resourceSlug);
+				// Extract canCreate, canEdit, canDelete, and canView from API response
+				setCanCreate(data.canCreate !== false); // Default to true if undefined
+				setCanEdit(data.canEdit !== false); // Default to true if undefined
+				setCanDelete(data.canDelete !== false); // Default to true if undefined
+				setCanView(data.canView !== false); // Default to true if undefined
+			} catch (err) {
+				setError(err instanceof Error ? err.message : translate('core:error.load_schema'));
+			} finally {
+				setLoading(false);
+			}
+		};
+
+		if (resourceSlug) {
+			// Set loading and clear schema together to prevent race conditions
+			// This prevents TableRenderer from rendering with mismatched schema/resourceKey
+			setLoading(true);
+			setTableSchema(null);
+			setTableSchemaResource(null);
+			fetchTableSchema();
+		}
+	}, [apiBaseUrl, resourceSlug]);
+
+	// Handlers for table actions - navigate to update URL (these are always same-resource)
+	const handleCreateClick = () => {
+		navigate(`/${resourceSlug}/create`);
+	};
+
+	const handleViewClick = (rowId: any) => {
+		navigate(`/${resourceSlug}/${rowId}`);
+	};
+
+	const handleEditClick = (rowId: any) => {
+		navigate(`/${resourceSlug}/${rowId}/edit`);
+	};
+
+	// Guard against rendering a schema that belongs to a previous resource
+	if (tableSchema && tableSchemaResource !== resourceSlug) {
+		return (
+			<div className="flex items-center justify-center py-12">
+				<Loader2 className="w-8 h-8 text-accent animate-spin" />
+				<span className="ml-3 text-fg-secondary">{translate('core:common.loading_ellipsis')}</span>
+			</div>
+		);
+	}
+
+	if (loading) {
+		return (
+			<div className="flex items-center justify-center py-12">
+				<Loader2 className="w-8 h-8 text-accent animate-spin" />
+				<span className="ml-3 text-fg-secondary">{translate('core:common.loading_ellipsis')}</span>
+			</div>
+		);
+	}
+
+	if (error) {
+		return (
+			<div className="">
+				<div className="text-center py-12">
+					<p className="text-red-600 mb-4">{error}</p>
+					<PillButton variant="primary" onClick={() => window.location.reload()}>
+						{translate('core:common.retry')}
+					</PillButton>
+				</div>
+			</div>
+		);
+	}
+
+	if (!tableSchema) {
+		return (
+			<div className="">
+				<div className="text-center py-12 text-fg-secondary">{translate('core:state.no_table_schema')}</div>
+			</div>
+		);
+	}
+
+	return (
+		<>
+			<div className="w-full max-w-7xl mx-auto">
+				<div className="w-full">
+					<TableRenderer
+						isResource={true}
+						schema={tableSchema}
+						apiUrl={`${apiBaseUrl}/${resourceSlug}`}
+						apiBaseUrl={apiBaseUrl}
+						onCreateClick={canCreate ? handleCreateClick : undefined}
+						onEditClick={canEdit ? handleEditClick : undefined}
+						onViewClick={canView ? handleViewClick : undefined}
+						canCreate={canCreate}
+						canEdit={canEdit}
+						canDelete={canDelete}
+						canView={canView}
+						refreshKey={refreshKey}
+					/>
+				</div>
+			</div>
+		</>
+	);
+}

package/src/plugin.ts

@@ -0,0 +1,110 @@
+import type { FieldRegistry, WidgetRegistry, BlockRegistry } from './types';
+import type { ColumnRegistry } from './contexts/ColumnRegistryContext';
+import type { AuthChallengeRegistry } from './contexts/AuthChallengeRegistryContext';
+import type { RuleDefinition } from '@maxal_studio/kratosjs';
+import type { SlotMap, ResolvedSlots } from './slots/types';
+import { appendSlots, sortSlots } from './slots/mergeSlots';
+
+/**
+ * Client-side manifest of a KratosJs plugin.
+ *
+ * Plugins export this from their `/client` entry. Components are statically
+ * imported, so the app's bundler (Vite) bundles them with a single shared
+ * React instance — no runtime transformation or dynamic URL loading.
+ *
+ * @example
+ * ```typescript
+ * // my-plugin/src/client/index.ts
+ * import { definePluginClient } from '@maxal_studio/kratosjs-react';
+ * import StarRatingField from './StarRatingField';
+ *
+ * export default definePluginClient({
+ *   name: 'star-rating',
+ *   fields: { 'star-rating': StarRatingField },
+ * });
+ * ```
+ */
+export interface KratosPluginClient {
+	/** Optional plugin name (for debugging) */
+	name?: string;
+	/** Custom field components keyed by field type (e.g. 'star-rating') */
+	fields?: FieldRegistry;
+	/** Custom column components keyed by column type */
+	columns?: ColumnRegistry;
+	/** Custom widget components keyed by widget type */
+	widgets?: WidgetRegistry;
+	/** Custom page block components keyed by block type */
+	blocks?: BlockRegistry;
+	/**
+	 * Challenge UI components keyed by challenge `type` (e.g. '2fa-totp'). Rendered on the
+	 * login screen when the server returns a matching pending challenge. Pairs with the
+	 * plugin's server-side `panel.registerAuthChallenge(...)`.
+	 */
+	authChallenges?: AuthChallengeRegistry;
+	/**
+	 * Custom validation rules keyed by rule name (e.g. 'phone'). Authored once as
+	 * a `RuleDefinition` and referenced from both the plugin's server `register()`
+	 * (via `panel.registerValidationRule`) and this client manifest, so the rule
+	 * behaves identically on both sides.
+	 */
+	rules?: Record<string, RuleDefinition>;
+	/**
+	 * UI slot contributions keyed by slot name (e.g. `'header.right'`). Unlike the
+	 * component registries above (which are 1:1 and override-based), slots are
+	 * 1:many — every plugin and the app can stack elements into the same slot.
+	 * A value is a single `SlotContribution` or an array of them.
+	 *
+	 * @example
+	 * slots: {
+	 *   'header.right': { id: 'docs-link', render: () => <a href="/docs">Docs</a> },
+	 * }
+	 */
+	slots?: SlotMap;
+}
+
+/**
+ * Identity helper that provides type inference for plugin client manifests.
+ */
+export function definePluginClient(client: KratosPluginClient): KratosPluginClient {
+	return client;
+}
+
+export interface MergedPluginRegistries {
+	fields: FieldRegistry;
+	columns: ColumnRegistry;
+	widgets: WidgetRegistry;
+	blocks: BlockRegistry;
+	authChallenges: AuthChallengeRegistry;
+	rules: Record<string, RuleDefinition>;
+	slots: ResolvedSlots;
+}
+
+/**
+ * Merge multiple plugin client manifests into flat component registries.
+ * Later plugins win on name collisions.
+ */
+export function mergePluginClients(plugins: KratosPluginClient[] = []): MergedPluginRegistries {
+	const merged: MergedPluginRegistries = {
+		fields: {},
+		columns: {},
+		widgets: {},
+		blocks: {},
+		authChallenges: {},
+		rules: {},
+		slots: {},
+	};
+
+	for (const plugin of plugins) {
+		Object.assign(merged.fields, plugin.fields ?? {});
+		Object.assign(merged.columns, plugin.columns ?? {});
+		Object.assign(merged.widgets, plugin.widgets ?? {});
+		Object.assign(merged.blocks, plugin.blocks ?? {});
+		Object.assign(merged.authChallenges, plugin.authChallenges ?? {});
+		Object.assign(merged.rules, plugin.rules ?? {});
+		// Slots stack (1:many) rather than override; later plugins append after earlier ones.
+		appendSlots(merged.slots, plugin.slots);
+	}
+
+	sortSlots(merged.slots);
+	return merged;
+}

package/src/runtime/conditions.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it, vi } from 'vitest';
+import { evaluateCondition } from '../runtime/conditions';
+
+describe('evaluateCondition', () => {
+	it('returns false for undefined', () => {
+		expect(evaluateCondition(undefined, {})).toBe(false);
+	});
+
+	it('returns boolean conditions as-is', () => {
+		expect(evaluateCondition(true, {})).toBe(true);
+		expect(evaluateCondition(false, {})).toBe(false);
+	});
+
+	it('evaluates a function string using get()', () => {
+		const condition = "({ get }) => get('status') === 'draft'";
+		expect(evaluateCondition(condition, { status: 'draft' })).toBe(true);
+		expect(evaluateCondition(condition, { status: 'published' })).toBe(false);
+	});
+
+	it('supports dot notation in get()', () => {
+		const condition = "({ get }) => get('author.name') === 'Jane'";
+		expect(evaluateCondition(condition, { author: { name: 'Jane' } })).toBe(true);
+		expect(evaluateCondition(condition, { author: null })).toBe(false);
+	});
+
+	it('exposes the operation to function conditions', () => {
+		const condition = "({ operation }) => operation === 'edit'";
+		expect(evaluateCondition(condition, {}, 'edit')).toBe(true);
+		expect(evaluateCondition(condition, {}, 'create')).toBe(false);
+	});
+
+	it('returns false when the function string throws', () => {
+		const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+		expect(evaluateCondition('({ get }) => { throw new Error("boom"); }', {})).toBe(false);
+		expect(errorSpy).toHaveBeenCalled();
+		errorSpy.mockRestore();
+	});
+
+	it('returns false for invalid function strings', () => {
+		const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+		expect(evaluateCondition('this is not js (', {})).toBe(false);
+		expect(errorSpy).toHaveBeenCalled();
+		errorSpy.mockRestore();
+	});
+});
+
+describe('evaluateCondition with structured AST', () => {
+	it('evaluates simple operators', () => {
+		expect(evaluateCondition({ op: 'eq', field: 'status', value: 'draft' }, { status: 'draft' })).toBe(true);
+		expect(evaluateCondition({ op: 'ne', field: 'status', value: 'draft' }, { status: 'live' })).toBe(true);
+		expect(evaluateCondition({ op: 'truthy', field: 'active' }, { active: 1 })).toBe(true);
+		expect(evaluateCondition({ op: 'falsy', field: 'active' }, { active: 0 })).toBe(true);
+		expect(evaluateCondition({ op: 'gt', field: 'age', value: 18 }, { age: 21 })).toBe(true);
+		expect(evaluateCondition({ op: 'lte', field: 'age', value: 18 }, { age: 18 })).toBe(true);
+	});
+
+	it('evaluates in/nin', () => {
+		expect(evaluateCondition({ op: 'in', field: 'role', value: ['admin', 'editor'] }, { role: 'admin' })).toBe(
+			true,
+		);
+		expect(evaluateCondition({ op: 'nin', field: 'role', value: ['admin'] }, { role: 'user' })).toBe(true);
+	});
+
+	it('evaluates the operation operator', () => {
+		expect(evaluateCondition({ op: 'operation', value: 'edit' }, {}, 'edit')).toBe(true);
+		expect(evaluateCondition({ op: 'operation', value: 'edit' }, {}, 'create')).toBe(false);
+	});
+
+	it('supports dot-notation fields', () => {
+		expect(evaluateCondition({ op: 'eq', field: 'author.name', value: 'Jane' }, { author: { name: 'Jane' } })).toBe(
+			true,
+		);
+	});
+
+	it('combines with all/any/not', () => {
+		const cond = {
+			all: [
+				{ op: 'eq' as const, field: 'status', value: 'draft' },
+				{
+					any: [
+						{ op: 'eq' as const, field: 'role', value: 'admin' },
+						{ op: 'truthy' as const, field: 'owner' },
+					],
+				},
+			],
+		};
+		expect(evaluateCondition(cond, { status: 'draft', role: 'admin' })).toBe(true);
+		expect(evaluateCondition(cond, { status: 'draft', owner: true })).toBe(true);
+		expect(evaluateCondition(cond, { status: 'live', role: 'admin' })).toBe(false);
+		expect(evaluateCondition({ not: { op: 'truthy', field: 'x' } }, { x: false })).toBe(true);
+	});
+
+	it('returns false for unknown operators', () => {
+		const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+		expect(evaluateCondition({ op: 'wat' as never, field: 'x' }, { x: 1 })).toBe(false);
+		expect(warnSpy).toHaveBeenCalled();
+		warnSpy.mockRestore();
+	});
+});